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Main Idea 



Method and apparatus for independent filtering of e-Commerce transactions 



1 . Describe your Invention, stating the problem solved (if appropriate), and indicating the advantages of 
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using the invention. 

The problem: E-Commerce systems typically have a policy for allowing transactions to proceed to 
completion. This policy may either be static (in that it is hard wired into the system) or dynamic in that it 
can be updated without redeploying the application. In either case, policies must be compatible with the 
deployed e-commerce system they are associated with. Frequently, there will be transactions that are 
allowed by the system even though the system operator/owner would not approve. 



The solution; This invention provides a method for enforcing additional constraints, thereby allowing the 
system owner/operator to extend the functionality of the system without the knowledge or assistance of 
the original system provider. It provides a generic means for blocking or modifying in-progress 
e-commerce transactions by intercepting, examining and possibly modifying one or more of the 
messages that constitute the transaction. The generic solution described here has several advantages 
over the classic integrated approach. 

• Uniform policy across different e-Commerce systems. 

• Ability to update the policy with arbitrary new code without re-deploying the e-Commerce systems 

• Ability to insert custom and proprietary filters without the knowledge or participation of the 
e-Commerce system vendor. 

• For instance, enforce policy such as usage of a pr^erred supplier for airiine ticket purchases. 

• Implement a custom approval/audit policy that is consistent across e-commerce systems. 

• Ability to block certain transactions that you do not wish to be active on your systems. 

• Masquerade the transaction so as to hide some source information from the vendor fulfilling an order. 
For instance, suppose a company employee wishes to electronically purchase software that is 
downloaded electronically. Masquerading could hide all information about the specific employee from 
the vendor while allowing the transaction to complete. 

In addition, this solution is well suited to providing protection against the following risks that are inherent 
in any e-Commerce environment; 

• Users may intentionally attempt to perform transactions that are allowed by the e-Commerce system 
but of which his employer would not approve. 

• Users may accidentally attempt to perform transactions that are allowed by the e-Commerce system 
but which they did not intend. 

• Unauthorized programs may attempt to perform transactions order under the auspices of a valid user. 

• Unauthorized users may attempt to use the system. 

• Legitimate programs may have undesired behavior that should be blocked. 

2. How does the invention solve the problem or achieve an advantage,(a description of "the invention", 
including figures inline as appropriate)? 

One embodiment of this invention would be software that inserts itself between all applications and the 
networking layer that is used to transport e-commerce traffic. This software would examine messages 
that pass through it and selects messages that are part of standard e-commerce transactions. The 
software would then examine them and analyze them for specific characteristics. If the analysis results so 
indicate, the message could be blocked or modified in a way that will enforce the policy that applies to the 
analysis results. The software could also take additional actions such as alerting, directly querying the 
user, logging results, etc. 

3. If the same advantage or problem has been identified by others (inside/outside IBM), how have those 
others solved it and does your solution differ and why is it better? 

Current solutions for policy enforcement are included as integral parts of an overall e-comnmerce 
offering. This solution offers a generic method to add enhanced filtering to e-comnmerce systems that are 
already deployed. Since this system could potentially covef all the installed e-commerce systems at a site 
there would be additional advantage in updating the system in real time. 
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4 If the invention is limplemented in a product or prototype, include technical details, purpose, disclosure 
details to others and the date of that implementation. 

Distinguishing factors: 

Installed as an add-on that can work with standards based e-commerce which we expect to be 
ubiquitous in the future. There are currently no products like this and we have not heard such 
products discussed. 

Policy can be applied across e-commerce offerings 
• Separates the e-commerce policy vendor from the e-commerce function vendor thus defining 
a new business category which we hope to be able to describe as a business methods patent. 

Random points: 

A possible start for claims: "'^^^ ^-^V 

1. A subsystem interposed between two or more parties that mtercepts e-commefcTfransactions - 
and takes actions based upon the properties of the e-commerce transactionfwhere the f 6 ^ 
presence of the subsystem does not require any changes to the protocols used by the parties. 

2. A system as in claim (1) where the subsystem interposed between two or more parties includes one 
or more software components that identifies e-commerce transaction related traffic even when other 
traffic is. passing between the parties. 

3. A system as in claim (1) where the subsystem interposed between two or more parties includes one 
or more software components that deduces what if any action should be taken in connection with an 
e-commerce transaction arriving at the subsystem. 

1 . A system as in claim (3) where the action is deduced in part or whole by applying predefined 
rules to the contents of one or more messages that comprise an e-commerce transaction 

2. A system as in claim (3) where the action is deduced in part or whole by applying predefined 
rules independent of the contents of any messages that comprise an e-commerce transaction. 

3. A system as in claim (3) where the action is deduced by applying predefined rules based entirely 
on the origin or Destination of one or more messages that comprise an e-commerce transaction 

4. Asystemasindaim(3)wheretheadionisdedu'^ 
information and receiving a reply. 

5. Asystemasindaim(3)wheretheactionisdedu(^byirTteractingw'rthahuman 

4. A system as in claim (1) where the subsystem interposed between two or more parties includes one 
or more software components that modifies e-commerce transactions arriving at the subsystem 
before it is passed to the intended party. 

5. A system as in claim (1) where the subsystem interposed between two or more parties includes one 
or more software components that does not pass a received message to the intended party 

6. A system as in claim (1) where the subsystem interposed between two or more parties includes one 
or more software components that pass a received message to a different party than the intended 
party. 

7. A system as in claim (1) where the subsystem interposed between two or more parties includes one 
or more software components that pass a received and modified message to a different party than 
the intended party. 

8. A system as in claim (1) where interposed is interpreted to mean that the subsystem is comprised in 
part or entirely of a software layer inserted between two existing software layers such that the 
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preexisting software layers continue to operate properly in the event the subsystem takes no action. 
9. A system as in claim (1 ) where interposed is interpreted to mean that the subsystem is comprised in 
part or entirely of a software object inserted between two existing software objects such that the 
preexisting software objects continue to operate properly in the event the subsystem takes no action. 
10. A system as in claim (1) where interposed is interpreted to mean that the subsystem is comprised in 
part or entirely of a software component inserted between two existing software components such 
that the preexisting software components continue to operate properly in the event the subsystem 
takes no action. 

11- A system as in claim (1 ) where parties is interpreted to mean any software that represents a person 
or institution that has the ability to transfer goods, services or money. 

12. A system as in claim (1 ) where parties is interpreted to mean any software that represents a person 
or institution that has the ability to transfer goods, services or money. 

1 3. A system as in claim (1 ) where e-commerce transaction is interpreted to mean any message traveling 
between any of the parties related to the transfer of goods, services or money. 

14. A system as in claim (1 ) where e-commerce transaction is interpreted to mean any collection of 
messages traveling between any of the parties that together enable the transfer of goods, services of 
money. 

'Critical Questions ( Questions 1 - 7 must be answered) 
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Patent Value Tool (Optional - this may be used by the Inventor and attorney to assist with the evalu 

(The Patent Value tool can be used by you or the evaluation team to determine the potential licensing 
value of your invention.) 

The. Patent Value Tool has not yet been used to calculate a score. 
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